Four layers, one missing
Software agents now buy and sell real services from each other, and the infrastructure for that commerce is arriving fast. This report maps the stack as it actually stands in October 2026 — who builds each layer, what it verifiably does, and where the structure has a hole. Every load-bearing claim below is sourced; announcements of intent are labeled as such.
The short version: the payment rail is a governed open standard with real traffic. The authority layer has a serious company-led candidate. The identity registry exists on-chain and is heavily populated. And the trust layer — the record of whether an agent has actually paid, been paid, and honored its obligations over time — does not exist as an open standard anywhere we can find. The one measurement of the incumbent reputation data, taken this month, shows it is almost entirely ungrounded in real transactions.
x402: the rail is built, governed, and busy
x402 is an HTTP-native payment protocol created by Coinbase in May 2025: a server answers a request with a 402 status and payment requirements, the client signs a payment payload, a facilitator verifies and settles it on-chain, and the resource is delivered. The spec (now v2, Apache-2.0) covers the core handshake, settlement schemes including exact, upto, and batched settlement, multiple chain families (EVM, Solana, Stellar, XRPL), and extensions for service discovery (the Bazaar), receipts, and sign-in.
Governance moved to the Linux Foundation this year: intent announced April 2, 2026, operational launch July 14 with 40 member organizations — Visa, Mastercard, American Express, Stripe, Google, AWS, Circle among the Premier tier — and 50+ members by October 1, when payments veteran Michael Hursta was appointed executive director. The Technical Steering Committee seats Coinbase (Erik Reppel, the protocol's creator), Cloudflare, and Stripe.
Two scope facts matter for everything that follows. First, the Foundation's mandate is the payments standard only: identity, verification, and reputation appear in no Foundation scope statement we reviewed. Second, the traffic is real but should be read carefully — the Foundation's own dashboard showed roughly 75 million transactions and $24 million in volume in the trailing 30 days, while independent analysis notes a large share of the protocol's late-2025 volume was memecoin activity rather than agent commerce. Protocol traffic is not yet proof of agentic spend.
The one identity-adjacent feature inside the spec, Sign-In-With-X, is wallet authentication: a client proves it controls a key — mainly to re-access purchased content. It establishes key possession only: no principal, no history, no standing.
x401: who authorized this agent?
The strongest candidate for the authority layer comes from outside the Foundation. Proof — an established identity-verification company — published x401 in June 2026, began a production rollout on October 15 (an agent identity wallet and MCP server), and demonstrated it jointly with Circle at Money20/20 on October 19–21. Contributors acknowledged in its launch include people from Circle, OpenAI, Okta, MATTR, and Lightspark.
The design: when a server needs to know who is calling, an HTTP 401 challenge asks the agent to present Verifiable Credentials proving two things — a verified human's identity attributes, and a signed delegation mandate from that human, with scope, spend limits, and duration — plus a check that the delegation has not been revoked. Proof's model is explicit that agents hold no identity of their own; they inherit the authorizing human's.
What x401 settles is authorization: this agent speaks for that verified principal, within these limits, right now. What it does not touch is behavior: how the agent has actually conducted itself across its payment history. Proof states it intends to place the protocol under neutral, independent governance; today it remains a company specification, not a Foundation workstream, and Proof is not on the Foundation's member roster.
ERC-8004: a populated registry with hollow reputation
On Ethereum, the registry substrate already exists. ERC-8004, authored by the Ethereum Foundation's dAI team with MetaMask/Consensys and contributors from Google and Coinbase, went live on mainnet on January 29, 2026, and registered tens of thousands of agents within weeks. It defines three registries: Identity (an ERC-721 agent ID with an off-chain registration file that can declare x402 support), Reputation (signed feedback, optionally linked to x402 payment proofs), and Validation (third-party verification of work). It deliberately excludes payments and is designed to compose with x402.
The architecture is right. The data, measured, is not. On October 14, 2026, the Agentic Finance Graph project published a fixture study of the Reputation Registry on Base: of 514,096 feedback entries, only 728 — 0.14% — came from a rater who had ever paid the agent being rated, and only 3 of those payments settled via x402. In other words, the ecosystem's flagship reputation layer consists almost entirely of ratings unbacked by any transaction between the parties. Follow-up work on "grounded" feedback — ratings that must carry proof of an actual transaction — is an acknowledged response to exactly this hole.
An identity registry tells the world an agent exists and what it claims to be. It does not, today, tell the world whether the agent has ever done anything.
The wallet rail commoditizes — and its builder declines verification
In August 2026 Cloudflare announced Wallets: an account wallet for the human owner, virtual wallets for agents with owner-set guardrails (allowance, allow list, maximum transaction size, human override), stablecoin payments over x402 for APIs and content, and human-readable agent handles at cloudflare.pay. It is a well-built version of the pattern the whole industry is converging on — which is the point. The wallet itself is becoming a commodity feature shipped by platforms.
Cloudflare is equally clear about what it is not building. In its own words: "We are not trying to define a particular schema or other verification system." Its identity primitive is deliberately thin — an optional, self-declared handle on a keypair — and Cloudflare says it will adopt identity-enrichment schemas as they develop through the x402 Foundation's initiatives.
Meanwhile the measurement literature keeps naming the consequence of an anonymous rail. TRM Labs, in its study of on-chain agent payments, puts it plainly: the protocol "wasn't built to answer, 'Who is responsible for this payment?'" — and notes that on existing agent registries, ownership declarations are voluntary, unverified, and used by only a minority of participants.
Standing: the layer with no builder
Line the layers up and the missing one is precise. Standing — a portable, revocable assessment of an agent computed from its anchored, verifiable payment history: obligations taken and settled, over what window, with what record — is specified by nobody and shipped by nobody as an open standard.
- x401 checks delegation revocation, not standing; authorization is not a track record.
- ERC-8004 stores feedback, but the feedback is measurably ungrounded in payments (Section 3), and the registry reaches EVM chains only.
- Nothing in any live system answers, at payment time, the question a seller or facilitator actually needs: is this agent currently in good standing, and what is that standing based on?
- The nearest production answer is proprietary: t54 Labs, a Foundation General member, sells transaction screening, "Know Your Agent" verification, and agent credit lines as institutional services — a service and a risk engine, not a published schema, priced for institutions.
History suggests this layer always arrives eventually: every mature transaction network develops a memory — trade-credit reporting, consumer credit files, certificate transparency — because pricing strangers as strangers forever is more expensive than keeping records. The open questions are empirical before they are architectural. How many registered agents have any verifiable track record at all? What does the distribution of real agent payment history look like once you measure it instead of assuming it? Those questions are answerable from public data today, and answering them is the necessary first step before anyone standardizes the layer. The Ideas Desk has lodged that measurement as SP-013.